PhishGraph AI

Graph-Enhanced Phishing & Business Email Compromise Detection

Connect identity, authentication, message intent, URL infrastructure, and campaign relationships into one explainable analyst decision.

message → identity → content / URL → graph links → decision → investigation

_{Product visualization. UI values are illustrative; measured public-replay metrics are reported below.}

The product idea

Phishing and BEC are not just text-classification problems. High-confidence investigations often depend on who the sender claims to be, where replies go, whether authentication failed, what the message asks the user to do, which domains/URLs are involved, and whether the same infrastructure is targeting other recipients.

01 · Identity Executive impersonation, reply-to mismatch, first-seen sender and authentication failures.

02 · Intent Urgency, payment, credential requests and recipient targeting become explainable content-risk signals.

03 · Infrastructure Sender domains, reply domains and URLs create reusable threat relationships.

04 · Campaign Connected components surface shared infrastructure and repeated attack campaigns.

Architecture

Every decision contains a class (benign, phishing, bec), a risk score, normalized features, and human-readable reasons. Campaign discovery then links messages that reuse sender domains, reply-to domains or URLs.

Measured synthetic replay

The checked-in fixture contains six synthetic messages: three malicious and three benign.

Metric	Result
Messages	6
True positives	3
False positives	0
Precision	1.00
Recall	1.00
False-positive rate	0.00
Campaign components	5

These results demonstrate the detection/evaluation mechanics on the included deterministic fixture. They are not production email-security efficacy claims.

Signal model

Signal family	Examples
Identity	executive impersonation, reply mismatch, first-seen sender
Authentication	normalized SPF / DKIM / DMARC failures
Content	urgency, payment requests, credential requests
URL / domain	suspicious TLD, mismatched or reused infrastructure
Behavioral	many recipients, unusual targeting patterns
Graph	sender / domain / URL connected components

60-second reviewer path

1. Review the product dashboard and architecture above.
2. Open src/phishgraph/features.py for explainable identity/content/URL signals.
3. Open src/phishgraph/detector.py for scoring and classification.
4. Open src/phishgraph/graph.py for campaign discovery.
5. Inspect reports/baseline.json and launch the analyst dashboard.

Run it

python -m venv .venv
source .venv/bin/activate
python -m pip install -e .
phishgraph --input sample_data/messages.jsonl --output reports/baseline.json
python -m unittest discover -s tests -v

Product dashboard

python -m pip install streamlit
streamlit run dashboard/app.py

The dashboard includes sender-domain risk trends, decision mix, campaign clusters, investigation queue, evidence-signal distributions and message-level drill-down.

Repository map

src/phishgraph/
├── models.py       normalized message record
├── features.py     identity, auth, content + URL features
├── detector.py     explainable scoring + class decision
├── graph.py        connected campaign discovery
├── evaluation.py   precision / recall / FPR
└── cli.py          deterministic replay entry point
sample_data/        synthetic labeled email telemetry
reports/            checked-in measured replay
assets/             product + architecture visuals
dashboard/          product-style analyst surface
tests/              scoring + graph invariants

Production evolution

A production system would ingest Microsoft 365 / Google Workspace telemetry, secure email gateway events, URL reputation, domain age, directory context and thread history; use calibrated ML/LLM models behind deterministic evidence constraints; and feed analyst dispositions back into thresholding and campaign intelligence.

Privacy boundary: the checked-in dataset is synthetic and contains no real mailbox content.